Developing information security policy in a multi-stakeholder urban environment: lessons from Surabaya, Indonesia

While ISPs were originally designed within single organisations, urban environments now require policies that accommodate the interests of multiple stakeholders. Focusing on Surabaya, Indonesia, and guided by the research question “what are the factors that influence development of ISPs in a multi-stakeholder context,” this study explores key dimensions in the development and implementation of ISPs in multi-stakeholder urban settings. Based on 40 semi-structured interviews, a thematic analysis was conducted to identify key recurring patterns across stakeholder perspectives. This paper identifies synergies between organisational and city-level contexts and proposes a set of extended features needed when government agencies, market providers, IT consultants, and citizens all interact and contribute to ISPs development. Recommendations for achieving better compliance include the importance of clear communication, inclusive stakeholder involvement beyond bureaucracy, inter-agency coordination, and an expanded feedback loop incorporating insights from both staff and citizens.